engineering-memory 1.11.27 → 1.11.29

package/runtime/dist/src/providers/gitlab-token-page.js

@@ -0,0 +1,226 @@
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import * as z from 'zod/v4';
+import { copies, escapeHtml, format, textDirection } from '../runtime/texts.js';
+import { GitLabError, gitLabAddress } from './gitlab.js';
+const text = z.string().min(1);
+const pageWording = z.strictObject({
+    title: text,
+    intro: text,
+    address: text,
+    addressHint: text,
+    token: text,
+    tokenHint: text,
+    save: text,
+    remove: text,
+    saved: text,
+    savedReadOnly: text,
+    removed: text,
+    rejected: text,
+    noApiScope: text,
+    unreachable: text,
+    certificate: text,
+    redirected: text,
+    notGitLab: text,
+    invalidAddress: text,
+    missingToken: text,
+    gitlabError: text,
+    failed: text,
+    expired: text,
+});
+const maximumBody = 8 * 1024;
+export class GitLabTokenPage {
+    tokens;
+    gitlab;
+    language;
+    server = null;
+    page = null;
+    timer = null;
+    queue = Promise.resolve();
+    constructor(tokens, gitlab, language) {
+        this.tokens = tokens;
+        this.gitlab = gitlab;
+        this.language = language;
+    }
+    async open(target) {
+        await this.close();
+        const server = createServer((request, response) => {
+            this.queue = this.queue.then(() => this.handle(request, response)).catch(() => undefined);
+        });
+        await new Promise((resolvePromise, reject) => {
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', resolvePromise);
+        });
+        server.unref();
+        const port = server.address().port;
+        const expiresAt = Date.now() + 10 * 60 * 1000;
+        this.server = server;
+        this.page = { nonce: randomBytes(32).toString('base64url'), port, ...target, expiresAt };
+        this.timer = setTimeout(() => void this.close(), expiresAt - Date.now());
+        this.timer.unref();
+        return {
+            url: `http://127.0.0.1:${port}/${this.page.nonce}`,
+            expiresAt: new Date(expiresAt).toISOString(),
+        };
+    }
+    async close() {
+        const server = this.server;
+        this.server = null;
+        this.page = null;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        if (!server)
+            return;
+        await new Promise((resolvePromise) => {
+            server.close(() => resolvePromise());
+            server.closeAllConnections();
+        });
+    }
+    async handle(request, response) {
+        const page = this.page;
+        try {
+            const own = page ? `127.0.0.1:${page.port}` : null;
+            if (!page || request.headers.host !== own)
+                return this.send(response, 421, await this.notice('expired'));
+            if (request.url !== `/${page.nonce}`)
+                return this.send(response, 404, await this.notice('expired'));
+            if (Date.now() >= page.expiresAt)
+                return this.finish(response, await this.notice('expired'), 410);
+            if (request.method === 'GET')
+                return this.send(response, 200, await this.form(page, page.address ?? ''));
+            if (request.method !== 'POST')
+                return this.send(response, 405, '', { Allow: 'GET, POST' });
+            if (request.headers.origin !== undefined && request.headers.origin !== `http://${own}`)
+                return this.send(response, 403, await this.notice('expired'));
+            if (!/^application\/x-www-form-urlencoded(;|$)/i.test(request.headers['content-type'] ?? ''))
+                return this.send(response, 415, await this.notice('failed'));
+            const body = await readBody(request);
+            if (body === null)
+                return this.send(response, 413, await this.notice('failed'));
+            const fields = new URLSearchParams(body);
+            const typed = fields.get('address') ?? '';
+            const address = gitLabAddress(typed);
+            if (!address)
+                return this.send(response, 400, await this.form(page, typed, 'invalidAddress'));
+            if (fields.get('action') === 'remove') {
+                await this.tokens.remove(address);
+                return this.finish(response, await this.notice('removed'));
+            }
+            const token = (fields.get('token') ?? '').trim();
+            if (!token || token.length > 1024 || /[\s\u0000-\u001f\u007f]/.test(token))
+                return this.send(response, 400, await this.form(page, address, 'missingToken'));
+            try {
+                await this.gitlab.user(address, token);
+                const scopes = await this.gitlab.scopes(address, token);
+                await this.tokens.save(page.host ?? new URL(address).host, address, token);
+                return this.finish(response, await this.notice(scopes && !scopes.includes('api') ? 'savedReadOnly' : 'saved'));
+            }
+            catch (error) {
+                if (!(error instanceof GitLabError))
+                    throw error;
+                return this.send(response, 400, await this.form(page, address, refusal(error), error));
+            }
+        }
+        catch {
+            return this.send(response, 500, await this.notice('failed'));
+        }
+    }
+    async finish(response, html, status = 200) {
+        this.page = null;
+        const server = this.server;
+        response.once('finish', () => {
+            if (this.server === server)
+                void this.close();
+        });
+        this.send(response, status, html);
+    }
+    send(response, status, html, headers = {}) {
+        response.writeHead(status, {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-store',
+            'Referrer-Policy': 'no-referrer',
+            'X-Content-Type-Options': 'nosniff',
+            'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+            ...headers,
+        });
+        response.end(html);
+    }
+    async wording() {
+        const told = await this.language().catch(() => undefined);
+        return copies(pageWording, 'gitlabToken', told)[0];
+    }
+    async notice(key) {
+        const { language, copy } = await this.wording();
+        return document(language, copy.title, `<p>${escapeHtml(copy[key])}</p>`);
+    }
+    async form(page, address, problem, error) {
+        const { language, copy } = await this.wording();
+        const shown = problem
+            ? format(copy[problem], language, {
+                address: error?.address ?? address,
+                status: error?.status ?? '-',
+            })
+            : null;
+        return document(language, copy.title, `<p>${escapeHtml(copy.intro)}</p>` +
+            (shown ? `<p class="problem" role="alert">${escapeHtml(shown)}</p>` : '') +
+            `<form method="post" action="/${page.nonce}" autocomplete="off">` +
+            `<label for="address">${escapeHtml(copy.address)}</label>` +
+            `<input id="address" name="address" type="url" required value="${escapeHtml(address)}">` +
+            `<p class="hint">${escapeHtml(copy.addressHint)}</p>` +
+            `<label for="token">${escapeHtml(copy.token)}</label>` +
+            `<input id="token" name="token" type="password" autocomplete="new-password" spellcheck="false">` +
+            `<p class="hint">${escapeHtml(copy.tokenHint)}</p>` +
+            `<div class="actions"><button name="action" value="save">${escapeHtml(copy.save)}</button>` +
+            `<button name="action" value="remove" class="secondary" formnovalidate>${escapeHtml(copy.remove)}</button></div>` +
+            `</form>`);
+    }
+}
+function refusal(error) {
+    switch (error.failure) {
+        case 'token_rejected':
+            return 'rejected';
+        case 'not_allowed':
+            return 'noApiScope';
+        case 'unreachable':
+            return 'unreachable';
+        case 'untrusted_certificate':
+            return 'certificate';
+        case 'redirected':
+            return 'redirected';
+        case 'not_found':
+        case 'unexpected_answer':
+            return 'notGitLab';
+        default:
+            return 'gitlabError';
+    }
+}
+function document(language, title, body) {
+    return (`<!doctype html><html lang="${escapeHtml(language)}" dir="${textDirection(language)}"><head>` +
+        '<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">' +
+        `<title>${escapeHtml(title)}</title><style>` +
+        'body{font:16px/1.5 system-ui,sans-serif;margin:0;padding:24px 16px;background:#f6f7f9;color:#1d2330}' +
+        'main{max-width:560px;margin:0 auto}h1{font-size:22px;line-height:1.3}' +
+        'label{display:block;font-weight:600;margin-top:20px}' +
+        'input{box-sizing:border-box;width:100%;padding:10px;margin-top:6px;font:inherit;border:1px solid #9aa3b2;border-radius:6px;background:#fff;color:inherit}' +
+        '.hint{margin:6px 0 0;font-size:14px;color:#4b5565}.problem{padding:10px 12px;border-radius:6px;background:#fdecec;color:#8a1c1c}' +
+        '.actions{display:flex;flex-wrap:wrap;gap:12px;margin-top:24px}' +
+        'button{font:inherit;padding:10px 16px;border-radius:6px;border:1px solid #2952cc;background:#2952cc;color:#fff;cursor:pointer}' +
+        'button.secondary{background:transparent;color:#2952cc}' +
+        '@media (prefers-color-scheme:dark){body{background:#14171c;color:#e6e9ef}input{background:#1d2129;border-color:#4b5565}.hint{color:#aab2c0}.problem{background:#3a1d1d;color:#f3b4b4}button{background:#5b7ef0;border-color:#5b7ef0}button.secondary{color:#9db3ff}}' +
+        `</style></head><body><main><h1>${escapeHtml(title)}</h1>${body}</main></body></html>`);
+}
+function readBody(request) {
+    return new Promise((resolvePromise, reject) => {
+        const chunks = [];
+        let size = 0;
+        request.on('data', (chunk) => {
+            size += chunk.length;
+            if (size <= maximumBody)
+                chunks.push(chunk);
+        });
+        request.once('end', () => resolvePromise(size > maximumBody ? null : Buffer.concat(chunks).toString('utf8')));
+        request.once('error', reject);
+    });
+}
+//# sourceMappingURL=gitlab-token-page.js.map

package/runtime/dist/src/providers/gitlab.js

@@ -0,0 +1,421 @@
+import { isIP } from 'node:net';
+import { join } from 'node:path';
+import * as z from 'zod/v4';
+import { principalFingerprint } from '../runtime/principal-state.js';
+import { readJson, removeFile, writeJson } from '../utilities/files.js';
+import { sha256 } from '../utilities/hash.js';
+export function gitLabRemote(remote) {
+    const trimmed = remote.trim();
+    const scpLike = /^(?:[^@/:]+@)?([^/:]+):(.+)$/.exec(trimmed);
+    let scheme = 'ssh';
+    let hostname;
+    let port = '';
+    let path;
+    if (scpLike &&
+        !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) &&
+        !/^[A-Za-z]:[\\/]/.test(trimmed)) {
+        hostname = scpLike[1].toLowerCase();
+        path = scpLike[2];
+    }
+    else if (URL.canParse(trimmed)) {
+        const url = new URL(trimmed);
+        scheme = url.protocol.slice(0, -1).toLowerCase();
+        hostname = url.hostname.toLowerCase();
+        port = url.port;
+        path = url.pathname;
+    }
+    else
+        return { refusal: 'local' };
+    if (!hostname || scheme === 'file')
+        return { refusal: 'local' };
+    if (isIP(hostname.replace(/^\[|\]$/g, '')))
+        return { refusal: 'ip' };
+    if (hostname === 'github.com' || hostname.endsWith('.github.com'))
+        return { refusal: 'github' };
+    const segments = path
+        .replace(/^\/+|\/+$/g, '')
+        .replace(/\.git$/i, '')
+        .split('/');
+    if (segments.length < 2 || !segments.every(pathSegment))
+        return { refusal: 'unsupported' };
+    if (scheme === 'https' || scheme === 'http') {
+        const host = port ? `${hostname}:${port}` : hostname;
+        return {
+            host,
+            address: scheme === 'http' && !loopback(hostname) ? `https://${hostname}` : `${scheme}://${host}`,
+            path: segments.join('/'),
+        };
+    }
+    if (['ssh', 'git+ssh', 'ssh+git', 'git'].includes(scheme))
+        return { host: hostname, address: `https://${hostname}`, path: segments.join('/') };
+    return { refusal: 'unsupported' };
+}
+export function gitLabAddress(value) {
+    const trimmed = value.trim();
+    if (trimmed.length > 300 || !URL.canParse(trimmed))
+        return null;
+    const url = new URL(trimmed);
+    const hostname = url.hostname.toLowerCase();
+    const path = url.pathname.replace(/\/+$/, '');
+    if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback(hostname))) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        isIP(hostname.replace(/^\[|\]$/g, '')) ||
+        hostname === 'github.com' ||
+        hostname.endsWith('.github.com') ||
+        !path.split('/').slice(1).every(pathSegment))
+        return null;
+    return `${url.protocol}//${url.host.toLowerCase()}${path}`;
+}
+export function projectPath(address, path) {
+    const prefix = new URL(address).pathname.replace(/^\/+|\/+$/g, '');
+    return prefix && path.startsWith(prefix + '/') ? path.slice(prefix.length + 1) : path;
+}
+function pathSegment(segment) {
+    return /^[\w.-]+$/.test(segment) && segment !== '.' && segment !== '..';
+}
+function loopback(hostname) {
+    return hostname === 'localhost' || hostname.endsWith('.localhost');
+}
+export class GitLabError extends Error {
+    failure;
+    address;
+    status;
+    detail;
+    constructor(failure, address, status, detail) {
+        super(`GitLab at ${address}: ${failure}${status ? ` (${status})` : ''}${detail ? `: ${detail}` : ''}`);
+        this.failure = failure;
+        this.address = address;
+        this.status = status;
+        this.detail = detail;
+        this.name = 'GitLabError';
+    }
+}
+const certificateCodes = new Set([
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'CERT_HAS_EXPIRED',
+    'CERT_NOT_YET_VALID',
+    'CERT_UNTRUSTED',
+    'CERT_SIGNATURE_FAILURE',
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+]);
+const connectCodes = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNREFUSED',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EADDRNOTAVAIL',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+function networkCode(error) {
+    let current = error;
+    for (let depth = 0; depth < 5 && current && typeof current === 'object'; depth++) {
+        const code = current.code;
+        if (typeof code === 'string')
+            return code;
+        const tried = current.errors;
+        current = current.cause ?? (Array.isArray(tried) ? tried[0] : null);
+    }
+    return null;
+}
+function gitLabMessage(body) {
+    if (!body)
+        return null;
+    let message = body;
+    try {
+        const parsed = JSON.parse(body);
+        message = parsed.message ?? parsed.error ?? null;
+    }
+    catch {
+        return null;
+    }
+    const text = typeof message === 'string' ? message : message ? JSON.stringify(message) : '';
+    return text.replace(/[\u0000-\u001f\u007f]+/g, ' ').slice(0, 200) || null;
+}
+export const mergeRequestSchema = z.object({
+    iid: z.number().int().positive(),
+    web_url: z.string().min(1).max(500),
+    state: z.string(),
+    draft: z.boolean().optional(),
+    work_in_progress: z.boolean().optional(),
+    sha: z.string().nullish(),
+    title: z.string().optional(),
+    source_branch: z.string(),
+    target_branch: z.string(),
+    project_id: z.number().optional(),
+    source_project_id: z.number().optional(),
+});
+export function reviewState(request) {
+    if (request.state === 'merged')
+        return 'merged';
+    if (request.state === 'closed')
+        return 'closed';
+    return request.draft || request.work_in_progress ? 'draft' : 'ready';
+}
+export class GitLabClient {
+    timeoutMs;
+    constructor(timeoutMs) {
+        this.timeoutMs = timeoutMs;
+    }
+    async user(address, token) {
+        await this.call(address, token, 'GET', '/user');
+    }
+    async scopes(address, token) {
+        try {
+            const self = z
+                .object({ scopes: z.array(z.string()) })
+                .safeParse(await this.call(address, token, 'GET', '/personal_access_tokens/self'));
+            return self.success ? self.data.scopes : null;
+        }
+        catch (error) {
+            if (error instanceof GitLabError &&
+                ['not_found', 'not_allowed', 'invalid_request'].includes(error.failure))
+                return null;
+            throw error;
+        }
+    }
+    async project(address, token, project) {
+        return await this.found(async () => this.shape(address, z.object({ id: z.number() }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}`)));
+    }
+    async branch(address, token, project, branch) {
+        const found = await this.found(async () => this.shape(address, z.object({ commit: z.object({ id: z.string(), title: z.string().nullish() }) }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/repository/branches/${encodeURIComponent(branch)}`)));
+        return found ? { commit: found.commit.id, title: found.commit.title ?? '' } : null;
+    }
+    async contains(address, token, project, branch, commit) {
+        const query = new URLSearchParams([
+            ['refs[]', commit],
+            ['refs[]', branch],
+        ]);
+        try {
+            const base = this.shape(address, z.object({ id: z.string() }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/repository/merge_base?${query}`));
+            return base.id === commit;
+        }
+        catch (error) {
+            if (error instanceof GitLabError &&
+                (error.failure === 'not_found' || error.failure === 'invalid_request'))
+                return false;
+            throw error;
+        }
+    }
+    async mergeRequests(address, token, project, branch, state) {
+        const query = new URLSearchParams({
+            source_branch: branch,
+            order_by: 'created_at',
+            sort: 'desc',
+            per_page: '20',
+            ...(state ? { state } : {}),
+        });
+        const listed = this.shape(address, z.array(mergeRequestSchema), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project.path)}/merge_requests?${query}`));
+        return listed.filter((request) => request.source_branch === branch &&
+            (request.source_project_id === undefined || request.source_project_id === project.id));
+    }
+    async mergeRequest(address, token, project, number) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/merge_requests/${number}`));
+    }
+    async createMergeRequest(address, token, project, request) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'POST', `/projects/${encodeURIComponent(project)}/merge_requests`, {
+            source_branch: request.source,
+            target_branch: request.target,
+            title: request.title,
+            ...(request.description ? { description: request.description } : {}),
+        }));
+    }
+    async retitleMergeRequest(address, token, project, number, title) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'PUT', `/projects/${encodeURIComponent(project)}/merge_requests/${number}`, { title }));
+    }
+    async found(read) {
+        try {
+            return await read();
+        }
+        catch (error) {
+            if (error instanceof GitLabError && error.failure === 'not_found')
+                return null;
+            throw error;
+        }
+    }
+    shape(address, schema, value) {
+        const parsed = schema.safeParse(value);
+        if (!parsed.success)
+            throw new GitLabError('unexpected_answer', address, null, null);
+        return parsed.data;
+    }
+    async call(address, token, method, path, body) {
+        let status;
+        let text;
+        try {
+            const response = await fetch(`${address}/api/v4${path}`, {
+                method,
+                redirect: 'manual',
+                headers: {
+                    'PRIVATE-TOKEN': token,
+                    Accept: 'application/json',
+                    ...(body ? { 'Content-Type': 'application/json' } : {}),
+                },
+                ...(body ? { body: JSON.stringify(body) } : {}),
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+            status = response.status;
+            text = await response.text();
+        }
+        catch (error) {
+            const code = networkCode(error);
+            if (code && certificateCodes.has(code))
+                throw new GitLabError('untrusted_certificate', address, null, code);
+            if ((code && connectCodes.has(code)) || method === 'GET')
+                throw new GitLabError('unreachable', address, null, code);
+            throw new GitLabError('unknown_outcome', address, null, code);
+        }
+        if (status >= 200 && status < 300) {
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                throw new GitLabError('unexpected_answer', address, status, null);
+            }
+        }
+        const failure = status >= 300 && status < 400
+            ? 'redirected'
+            : status === 401
+                ? 'token_rejected'
+                : status === 403
+                    ? 'not_allowed'
+                    : status === 404
+                        ? 'not_found'
+                        : status === 409
+                            ? 'conflict'
+                            : status === 429
+                                ? 'rate_limited'
+                                : status >= 500
+                                    ? 'server_error'
+                                    : 'invalid_request';
+        throw new GitLabError(failure, address, status, gitLabMessage(text));
+    }
+}
+const savedAddresses = z.object({
+    schemaVersion: z.literal(1),
+    principalHash: z.string().min(1),
+    addresses: z.array(z.object({ host: z.string().min(1), address: z.string().min(1) })),
+});
+export class GitLabTokens {
+    stateRoot;
+    credentials;
+    path;
+    queue = Promise.resolve();
+    constructor(stateRoot, credentials) {
+        this.stateRoot = stateRoot;
+        this.credentials = credentials;
+        this.path = join(stateRoot, 'gitlab-addresses.json');
+    }
+    async address(host) {
+        return (await this.current())?.addresses.find((entry) => entry.host === host)?.address ?? null;
+    }
+    async forLink(host, repository) {
+        const addresses = [...new Set((await this.current())?.addresses.map((entry) => entry.address))]
+            .filter((address) => {
+            const url = new URL(address);
+            const prefix = url.pathname.replace(/^\/+/, '');
+            return url.host === host && (!prefix || repository.startsWith(prefix + '/'));
+        })
+            .sort((left, right) => right.length - left.length);
+        return addresses[0]
+            ? { address: addresses[0], project: projectPath(addresses[0], repository) }
+            : null;
+    }
+    async token(address) {
+        const principal = await this.principal();
+        return principal ? await this.credentials.get(tokenName(principal, address)) : null;
+    }
+    async any() {
+        return Boolean((await this.current())?.addresses.length);
+    }
+    async save(host, address, token) {
+        await this.exclusive(async () => {
+            const principal = await this.principal();
+            if (!principal)
+                throw new Error('Sign in to Engineering Memory before saving a GitLab token.');
+            let saved = await this.read();
+            if (saved && saved.principalHash !== principal) {
+                await this.deleteTokens(saved);
+                saved = null;
+            }
+            const previous = saved?.addresses.find((entry) => entry.host === host)?.address;
+            await this.credentials.set(tokenName(principal, address), token);
+            const addresses = [
+                ...(saved?.addresses ?? []).filter((entry) => entry.host !== host),
+                { host, address },
+            ];
+            await writeJson(this.path, { schemaVersion: 1, principalHash: principal, addresses }, this.stateRoot);
+            if (previous && !addresses.some((entry) => entry.address === previous))
+                await this.credentials.delete(tokenName(principal, previous));
+        });
+    }
+    async remove(address) {
+        await this.exclusive(async () => {
+            const principal = await this.principal();
+            if (!principal)
+                return;
+            await this.credentials.delete(tokenName(principal, address));
+            const saved = await this.read();
+            if (saved?.principalHash !== principal)
+                return;
+            await writeJson(this.path, { ...saved, addresses: saved.addresses.filter((entry) => entry.address !== address) }, this.stateRoot);
+        });
+    }
+    async clear() {
+        await this.exclusive(async () => {
+            const saved = await this.read();
+            if (saved)
+                await this.deleteTokens(saved);
+            await removeFile(this.path, this.stateRoot);
+        });
+    }
+    async deleteTokens(saved) {
+        for (const address of new Set(saved.addresses.map((entry) => entry.address)))
+            await this.credentials.delete(tokenName(saved.principalHash, address));
+    }
+    async current() {
+        const principal = await this.principal();
+        const saved = principal ? await this.read() : null;
+        return saved?.principalHash === principal ? saved : null;
+    }
+    async read() {
+        const parsed = savedAddresses.safeParse(await readJson(this.path, this.stateRoot));
+        return parsed.success ? parsed.data : null;
+    }
+    async principal() {
+        const accessToken = await this.credentials.get('access-token');
+        if (!accessToken)
+            return null;
+        try {
+            return principalFingerprint(accessToken);
+        }
+        catch {
+            return null;
+        }
+    }
+    async exclusive(action) {
+        const previous = this.queue;
+        let release = () => undefined;
+        this.queue = new Promise((resolvePromise) => {
+            release = resolvePromise;
+        });
+        await previous;
+        try {
+            await action();
+        }
+        finally {
+            release();
+        }
+    }
+}
+function tokenName(principal, address) {
+    return `gitlab-token-${sha256(`${principal}\n${address}`).slice(0, 32)}`;
+}
+//# sourceMappingURL=gitlab.js.map

package/runtime/dist/src/runtime/api-client.js

@@ -52,6 +52,13 @@ export const backendRecoveryOperationNames = [
     'task.resolve_pending_delivery',
     'task.delivery',
     'task.review_request',
+    'project.review_policy',
+    'review.queue',
+    'review.get',
+    'review.start',
+    'review.submit',
+    'review.reject_finding',
+    'review.conclude',
 ];
 const backendRecoveryOperations = new Set(backendRecoveryOperationNames);
 const browserSigninRecovery = 'auth.signin_browser';